Microsoft Visual Studio vulnerabilities

56 CVEs affecting Microsoft Visual Studio, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-49739, published 2025-07-08.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2008-3704, published 2008-08-18. High severity, CVSS 9.3. EPSS: 55.9% chance of exploitation in the next 30 days. Heap-based buffer overflow in the MaskedEdit ActiveX control in Msmask32.ocx 6.0.81.69, and possibly other versions before 6.0.84.18, in Microsoft Visual Studio 6.0, Visual Basic 6.0, Visual Studio…
• CVE-2009-2493, published 2009-07-29. High severity, CVSS 8.8. EPSS: 37.8% chance of exploitation in the next 30 days. The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold and SP1, and Visual C++ 2005 SP1 and 2008 Gold and SP1; and Windows 2000 SP4, XP SP2…
• CVE-2009-0901, published 2009-07-29. High severity, CVSS 8.8. EPSS: 36.6% chance of exploitation in the next 30 days. The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold, and Visual C++ 2005 SP1 and 2008 Gold and SP1; and Windows 2000 SP4, XP SP2 and SP3,…
• CVE-2009-2495, published 2009-07-29. Medium severity, CVSS 6.5. EPSS: 34.3% chance of exploitation in the next 30 days. The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold and SP1, and Visual C++ 2005 SP1 and 2008 Gold and SP1 does not properly enforce…
• CVE-2018-8172, published 2018-07-11. High severity, CVSS 7.8. EPSS: 33.6% chance of exploitation in the next 30 days. A remote code execution vulnerability exists in Visual Studio software when the software does not check the source markup of a file for an unbuilt project, aka "Visual Studio Remote Code Execution…
• CVE-2007-4891, published 2007-09-14. Medium severity, CVSS 6.8. EPSS: 31% chance of exploitation in the next 30 days. A certain ActiveX control in PDWizard.ocx 6.0.0.9782 and earlier in Microsoft Visual Studio 6.0 exposes dangerous (1) StartProcess, (2) SyncShell, (3) SaveAs, (4) CABDefaultURL, (5) CABFileName, and…
• CVE-2009-2501, published 2009-10-14. High severity, CVSS 9.3. EPSS: 26.7% chance of exploitation in the next 30 days. Heap-based buffer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Office Project 2002 SP1,…
• CVE-2007-0468, published 2007-01-24. Medium severity, CVSS 6.8. EPSS: 24.8% chance of exploitation in the next 30 days. Stack-based buffer overflow in rcdll.dll in msdev.exe in Visual C++ (MSVC) in Microsoft Visual Studio 6.0 SP6 allows user-assisted remote attackers to execute arbitrary code via a long file path in…
• CVE-2009-2500, published 2009-10-14. High severity, CVSS 9.3. EPSS: 23.6% chance of exploitation in the next 30 days. Integer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Office Project 2002 SP1, Visio 2002…
• CVE-2009-3126, published 2009-10-14. High severity, CVSS 9.3. EPSS: 23.5% chance of exploitation in the next 30 days. Integer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Office Project 2002 SP1, Visio 2002…

Latest

• CVE-2025-49739, published 2025-07-08. High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days. Improper link resolution before file access ('link following') in Visual Studio allows an unauthorized attacker to elevate privileges over a network.
• CVE-2024-43603, published 2024-10-08. Medium severity, CVSS 5.5. EPSS: 0.8% chance of exploitation in the next 30 days. Visual Studio Collector Service Denial of Service Vulnerability
• CVE-2024-20656, published 2024-01-09. High severity, CVSS 7.8. EPSS: 3.9% chance of exploitation in the next 30 days. Visual Studio Elevation of Privilege Vulnerability
• CVE-2023-24897, published 2023-06-14. High severity, CVSS 7.8. EPSS: 1.2% chance of exploitation in the next 30 days. .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability
• CVE-2023-33139, published 2023-06-14. Medium severity, CVSS 5.5. EPSS: 0.8% chance of exploitation in the next 30 days. Visual Studio Information Disclosure Vulnerability
• CVE-2022-35827, published 2022-08-09. High severity, CVSS 8.8. EPSS: 2.2% chance of exploitation in the next 30 days. Visual Studio Remote Code Execution Vulnerability
• CVE-2022-35826, published 2022-08-09. High severity, CVSS 8.8. EPSS: 2.2% chance of exploitation in the next 30 days. Visual Studio Remote Code Execution Vulnerability
• CVE-2022-35825, published 2022-08-09. High severity, CVSS 8.8. EPSS: 2.2% chance of exploitation in the next 30 days. Visual Studio Remote Code Execution Vulnerability
• CVE-2022-35777, published 2022-08-09. High severity, CVSS 8.8. EPSS: 2% chance of exploitation in the next 30 days. Visual Studio Remote Code Execution Vulnerability
• CVE-2021-42277, published 2021-11-10. Medium severity, CVSS 5.5. EPSS: 0.9% chance of exploitation in the next 30 days. Diagnostics Hub Standard Collector Elevation of Privilege Vulnerability